to a single node cluster, pods that check multi- node functionalities will remain in the Pending state. This is expected since these pods need at least 2 nodes to be scheduled successfully. Next steps "kube-dns-5f8689dbc9-j7x5f" deleted pod "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0 to a single node cluster, pods that check multi- node functionalities will remain in the Pending state. This is expected since these pods need at least 2 nodes to be scheduled successfully. Now that you

detect and use the best configuration possible for the Kubernetes distribution you are using. All state is stored using Kubernetes CRDs. This is the best installation method for most use cases. For large Install the latest version of the Cilium CLI. The Cilium CLI can be used to install Cilium, inspect the state of a Cilium installation, and enable/disable various features (e.g. clustermesh, Hubble). Linux "kube-dns-5f8689dbc9-j7x5f" deleted pod "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0

detect and use the best configuration possible for the Kubernetes distribution you are using. All state is stored using Kubernetes CRDs. This is the best installation method for most use cases. For large Install the latest version of the Cilium CLI. The Cilium CLI can be used to install Cilium, inspect the state of a Cilium installation, and enable/disable various features (e.g. clustermesh, Hubble). Linux "kube-dns-5f8689dbc9-j7x5f" deleted pod "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0

automa�cally re- created by the cilium-etcd-operator. Cilium will automa�cally recover and re- create all state in etcd. This opera�on can take can couple of seconds and may cause minor disrup�ons as ongoing distributed "kube-dns-5f8689dbc9-j7x5f" deleted pod "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0 create-access-key --user-name kops kops requires the crea�on of a dedicated S3 bucket in order to store the state and representa�on of the cluster. You will need to change the bucket name and provide your unique

to a single node cluster, pods that check multi- node functionalities will remain in the Pending state. This is expected since these pods need at least 2 nodes to be scheduled successfully. Specify Environment "kube-dns-5f8689dbc9-j7x5f" deleted pod "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0 to a single node cluster, pods that check multi- node functionalities will remain in the Pending state. This is expected since these pods need at least 2 nodes to be scheduled successfully. Specify Environment

takes you through the quick installation procedure. The default settings will store all required state using Kubernetes custom resource definitions (CRDs). This is the simplest installation method as it CRDs to store and propagate state between agents. Use of CRDs can impose scale limitations depending on the size of your environment. Use of etcd optimizes the propagation of state between agents. This guide providing etcd will not be critical to the availability of Cilium but will reduce the efficacy of state propagation. This allows the managed etcd to recover while depending on Cilium itself to provide connectivity

"kube-dns-5f8689dbc9-j7x5f" deleted pod "kube-dns-autoscaler-76fcd5f658-22r72" deleted pod "kube-state-metrics-7d9774bbd5-n6m5k" deleted pod "l7-default-backend-6f8697844f-d2rq2" deleted pod "metrics-server-v0 takes you through the quick installation procedure. The default settings will store all required state using Kubernetes custom resource definitions (CRDs). This is the simplest installation method as it CRDs to store and propagate state between agents. Use of CRDs can impose scale limitations depending on the size of your environment. Use of etcd optimizes the propagation of state between agents. This guide

dnf install nmap-ncat $ nc -4kle /bin/cat 127.0.0.1 7777 & [1] 1289 $ ss -4tlpn sport = 7777 State Recv-Q Send-Q Local Address:Port Peer Address:Port Process LISTEN 0 10 127.0.0.1:7777 IP vm $ ip -4 addr show eth0 2: eth0: mtu 1500 qdisc fq_codel state UP group default qlen 1000 inet 192.168.122.221/24 brd 192.168.122.255 scope global dynamic noprefixroute preferred_lft 2563sec host $ nmap -sT -p 1-1000 192.168.122.221 … Not shown: 999 closed ports PORT STATE SERVICE 22/tcp open ssh Nmap done: 1 IP address (1 host up) scanned in 0.07 seconds scan first

Policy is enforced by attaching BPF programs to LSM hooks ▶ Integrates userspace and kernelspace state into policy decisions 1 / 7 Motivation ▶ Existing process confinement mechanisms are complex seccomp-bpf Changes the Game eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes, uprobes, etc.) with policy enforcement (LSM probes) ▶ Rapid prototyping ▶ Safe production

SSDs, 128GB/s 8x throughput gap https://cacm.acm.org/magazines/2019/6/237002-programmable-solid-state-stora ge-in-future-cloud-datacenters/fulltext?mobile=false whoami ● Giulia Frascaria ● PhD student